's comments, the point is that there should be a single authority for any given concept. I like to look at the concept of "Who cares?", as in "Which entity is the one that should be the Subject Matter Expert for this concept?". Every other entity should then defer questions to that SME. Sooo, if you have authorization as a concept, have one authz entity that does the right thing. Everyone else talks to this guy.
Also, you've got code (plugins) that are really configuration items (who can login, etc). Don't conflate behaviors (code) with input (data).